@pensar/apex 2.5.0 → 2.6.1-canary.0cc77dcc

package/build/{cli-zav1yx5k.js → cli-2dqvgkh8.js}

@@ -1,114 +1,70 @@
 import {
-  AppsDiscoveryResultSchema,
-  DiscoverySummarySchema,
-  EndpointSchema,
-  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-7vg06q5r.js";
+  collectCommand,
+  FindingsRegistry,
+  inMemoryRegistryProvider,
+  withFindingPersistedHook,
+  assertDepth,
+  inProcessSeams,
+  resolveItemHooks,
+  toGrpcPentestContext,
+  grpcAuthorityTarget,
+  inProcessSubagentSpawner,
+  pLimit,
+  PLAN_MODE_TOOL_NAMES,
+  OffensiveSecurityAgent
+} from "./cli-3p4gyc9m.js";
 import {
-  BlackboxAttackSurfaceAgent
-} from "./cli-y3dpm18e.js";
+  BlackboxAttackSurfaceAgent2
+} from "./cli-xn12g67s.js";
 import {
-  TargetedPentestAgent,
-  buildPentestSystemPrompt
-} from "./cli-3py0a0wg.js";
+  TargetedPentestAgent2,
+  buildPentestSystemPrompt2
+} from "./cli-vfta27tv.js";
 import {
-  REPORT_FILENAME_JSON,
-  REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
-  renderMarkdown
-} from "./cli-vkbzcnw1.js";
+  renderMarkdown,
+  REPORT_FILENAME_MD,
+  REPORT_FILENAME_JSON
+} from "./cli-fapvkkbh.js";
 import {
-  CodeAgent
-} from "./cli-73k43t1r.js";
+  CodeAgent2
+} from "./cli-8s4ew1hv.js";
 import {
-  FindingsRegistry,
-  OffensiveSecurityAgent,
-  PLAN_MODE_TOOL_NAMES,
-  grpcAuthorityTarget,
-  pLimit,
-  runWithBoundedConcurrency,
-  toGrpcPentestContext
-} from "./cli-sx3jkv7p.js";
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
+  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
+  EndpointSchema2,
+  AppInfoSchema2,
+  AppsDiscoveryResultSchema2,
+  DiscoverySummarySchema2
+} from "./cli-9s7snz6x.js";
 import {
   createThreatModelPrompt
-} from "./cli-fw5r7pfj.js";
+} from "./cli-q126f6ef.js";
 import {
-  createLogger,
   hasToolCall,
   init_dist,
-  init_id,
+  scopedLogger,
   init_lazyLogger,
   init_session,
-  init_structured,
+  createLogger,
+  init_structured
+} from "./cli-c0ha5wh1.js";
+import {
   newSessionId,
-  scopedLogger
-} from "./cli-p4r7q012.js";
+  init_id
+} from "./cli-se8ae8z3.js";
 import {
-  __require
-} from "./cli-bc05qbss.js";
-
-// src/core/workflows/pentest.ts
-init_dist();
-import { existsSync as existsSync13, readdirSync as readdirSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join18 } from "node:path";
-
-// src/core/agents/specialized/pentest/planPrompt.ts
-var PLAN_PHASE_SYSTEM_PROMPT = `You are an expert penetration tester performing reconnaissance and planning.
-
-Your job is to analyze the target, understand its attack surface, and create a comprehensive testing plan. You have READ-ONLY tools available — you can probe the target but NOT exploit it.
-
-Methodology:
-1. RECALL — Call list_memories to check for relevant knowledge from previous engagements.
-2. PROBE — Use http_request and browser tools to understand the target's behavior, technology stack, and input vectors.
-3. ANALYZE — Identify technologies, endpoints, authentication mechanisms, input parameters, and potential vulnerability classes.
-4. PLAN — Write a structured pentest plan via write_plan with the following sections:
-   - **Objective** — engagement goals
-   - **Scope** — in-scope targets, exclusions
-   - **Reconnaissance Findings** — technology stack, endpoints, authentication mechanisms discovered
-   - **Attack Surface Map** — entry points ranked by exposure
-   - **Prioritized Attack Vectors** — ordered by impact, with endpoint, vulnerability class, rationale, and test approach per vector
-   - **Testing Methodology** — concrete techniques and payloads per vector (OWASP categories)
-   - **Estimated Action Tiers** — anticipated T1–T5 action counts for operator awareness
-5. DECOMPOSE — Call create_task for each attack vector in the plan. One task per technique × endpoint combination.
-6. SUBMIT — Call submit_plan when the plan is complete and all tasks are created.
-
-Guidelines:
-- Be thorough in reconnaissance — probe different endpoints, check response headers, test authentication flows
-- Rank attack vectors by likelihood of success and potential impact
-- Each task should be atomic and testable independently
-- Include authentication bypass, injection, access control, and business logic testing as appropriate`;
-function buildPlanPrompt(target, objectives, grpc) {
-  const objectiveList = objectives.map((o, i) => `${i + 1}. ${o}`).join(`
-`);
-  const grpcSection = grpc ? `
-## gRPC Target
-This target is a **gRPC method**, not a plain HTTP endpoint — plan gRPC-specific attack vectors (reflection/schema recovery, per-method missing-auth, BOLA on request-message IDs, metadata trust, \`:path\` authz bypass, protobuf fuzzing, streaming abuse) rather than HTTP-centric ones.
-- **Transport:** ${grpc.transport}
-- **Service:** ${grpc.serviceFqn}
-- **Method:** ${grpc.method}${grpc.streamingType ? `
-- **Streaming:** ${grpc.streamingType}` : ""}${grpc.host ? `
-- **Authority (host):** ${grpc.host}` : ""}
-` : "";
-  return `# Planning Assignment
-
-## Target
-- **URL:** ${target}
-${grpcSection}
-## Objectives
-${objectiveList}
-
-## Instructions
-1. Probe the target to understand its behavior and attack surface
-2. Write a comprehensive pentest plan via write_plan
-3. Create tasks for each attack vector via create_task
-4. Submit the plan via submit_plan when complete`;
-}
-
-// src/core/workflows/pentest.ts
-init_structured();
+  init_zod
+} from "./cli-3qznjsnr.js";
+import {
+  string,
+  number,
+  array,
+  object,
+  union
+} from "./cli-mz5pk30x.js";
 
 // src/core/session/execution-metrics.ts
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
@@ -205,6 +161,66 @@ function formatDurationHmsFromMs(durationMs) {
   return `${hours}h${minutes}m${seconds}s`;
 }
 
+// src/core/workflows/pentest.ts
+init_dist();
+import { existsSync as existsSync12, readdirSync as readdirSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join17 } from "node:path";
+
+// src/core/agents/specialized/pentest/planPrompt.ts
+var PLAN_PHASE_SYSTEM_PROMPT = `You are an expert penetration tester performing reconnaissance and planning.
+
+Your job is to analyze the target, understand its attack surface, and create a comprehensive testing plan. You have READ-ONLY tools available — you can probe the target but NOT exploit it.
+
+Methodology:
+1. RECALL — Call list_memories to check for relevant knowledge from previous engagements.
+2. PROBE — Use http_request and browser tools to understand the target's behavior, technology stack, and input vectors.
+3. ANALYZE — Identify technologies, endpoints, authentication mechanisms, input parameters, and potential vulnerability classes.
+4. PLAN — Write a structured pentest plan via write_plan with the following sections:
+   - **Objective** — engagement goals
+   - **Scope** — in-scope targets, exclusions
+   - **Reconnaissance Findings** — technology stack, endpoints, authentication mechanisms discovered
+   - **Attack Surface Map** — entry points ranked by exposure
+   - **Prioritized Attack Vectors** — ordered by impact, with endpoint, vulnerability class, rationale, and test approach per vector
+   - **Testing Methodology** — concrete techniques and payloads per vector (OWASP categories)
+   - **Estimated Action Tiers** — anticipated T1–T5 action counts for operator awareness
+5. DECOMPOSE — Call create_task for each attack vector in the plan. One task per technique × endpoint combination.
+6. SUBMIT — Call submit_plan when the plan is complete and all tasks are created.
+
+Guidelines:
+- Be thorough in reconnaissance — probe different endpoints, check response headers, test authentication flows
+- Rank attack vectors by likelihood of success and potential impact
+- Each task should be atomic and testable independently
+- Include authentication bypass, injection, access control, and business logic testing as appropriate`;
+function buildPlanPrompt(target, objectives, grpc) {
+  const objectiveList = objectives.map((o, i) => `${i + 1}. ${o}`).join(`
+`);
+  const grpcSection = grpc ? `
+## gRPC Target
+This target is a **gRPC method**, not a plain HTTP endpoint — plan gRPC-specific attack vectors (reflection/schema recovery, per-method missing-auth, BOLA on request-message IDs, metadata trust, \`:path\` authz bypass, protobuf fuzzing, streaming abuse) rather than HTTP-centric ones.
+- **Transport:** ${grpc.transport}
+- **Service:** ${grpc.serviceFqn}
+- **Method:** ${grpc.method}${grpc.streamingType ? `
+- **Streaming:** ${grpc.streamingType}` : ""}${grpc.host ? `
+- **Authority (host):** ${grpc.host}` : ""}
+` : "";
+  return `# Planning Assignment
+
+## Target
+- **URL:** ${target}
+${grpcSection}
+## Objectives
+${objectiveList}
+
+## Instructions
+1. Probe the target to understand its behavior and attack surface
+2. Write a comprehensive pentest plan via write_plan
+3. Create tasks for each attack vector via create_task
+4. Submit the plan via submit_plan when complete`;
+}
+
+// src/core/workflows/pentest.ts
+init_structured();
+
 // src/core/session/loader.ts
 init_structured();
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
@@ -293,9 +309,9 @@ function readAgentManifest(session) {
     return [];
   }
 }
-function buildManifestEntries(targets) {
+function buildManifestEntries(targets, mintId = () => newSessionId()) {
   return targets.map((t, i) => {
-    const sessionId = newSessionId();
+    const sessionId = mintId(t.name ?? "pentest-worker", i);
     return {
       id: sessionId,
       sessionId,
@@ -485,10 +501,10 @@ function loadSubagents(rootPath) {
   const subagentsPath = join2(rootPath, SUBAGENTS_DIR);
   const manifestNameById = new Map;
   {
-    const manifestPath2 = join2(rootPath, MANIFEST_FILE);
-    if (existsSync2(manifestPath2)) {
+    const manifestPath = join2(rootPath, MANIFEST_FILE);
+    if (existsSync2(manifestPath)) {
       try {
-        const manifest = JSON.parse(readFileSync2(manifestPath2, "utf-8"));
+        const manifest = JSON.parse(readFileSync2(manifestPath, "utf-8"));
         for (const entry of manifest)
           manifestNameById.set(entry.id, entry.name);
       } catch {}
@@ -638,7 +654,7 @@ init_lazyLogger();
 
 // src/core/workflows/whiteboxAttackSurface.ts
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync11,
   mkdirSync as mkdirSync2,
   readdirSync as readdirSync10,
   readFileSync as readFileSync9,
@@ -646,6 +662,7 @@ import {
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { join as join16 } from "node:path";
+init_zod();
 
 // src/core/agents/specialized/whiteboxAttackSurface/endpointDocumentationAgent.ts
 init_id();
@@ -736,64 +753,64 @@ async function runEndpointDocumentationAgent(opts) {
     thinkingEffort,
     projectThreatModel,
     parentSubagentId,
-    agentLimiter
+    agentLimiter,
+    subagentSpawner,
+    hooks,
+    mintChildId
   } = opts;
-  const subagentId = newSessionId();
   const displayMethod = getDocumentMethod(endpoint);
   const displayName = `${app.name}: ${displayMethod.join(",")} ${endpoint.path}`;
-  eventBus?.emit("subagent-spawn", {
-    subagentId,
-    name: displayName,
-    input: {
-      app: app.name,
-      type: "endpointDocumentation",
-      method: displayMethod,
-      path: endpoint.path
-    },
-    parentSubagentId
-  });
+  const subagentId = mintChildId ? mintChildId(displayName) : newSessionId();
   const objective = buildEndpointDocumentationObjective({
     app,
     codebasePath,
     endpoint,
     frameworks
   });
-  const agent = new CodeAgent({
-    codebasePath,
-    objective,
-    system: WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
-    model,
-    session,
-    authConfig,
-    abortSignal,
-    attackSurfaceRegistry,
-    eventBus,
+  const spawner = subagentSpawner ?? inProcessSubagentSpawner;
+  const spawnChild = () => spawner.spawn({
+    spec: {
+      type: "code",
+      codebasePath,
+      objective,
+      system: WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
+      excludeTools: ["document_app", "list_files", "grep"],
+      responseSchema: DiscoverySummarySchema2,
+      projectThreatModel,
+      attackSurfaceRegistry
+    },
+    runtime: {
+      model,
+      session,
+      authConfig,
+      abortSignal,
+      enableThinking,
+      thinkingEffort,
+      openAIReasoningEffort,
+      onStepFinish,
+      onCacheMetrics,
+      backends: hooks?.backends,
+      sandbox: hooks?.sandbox,
+      languageModelMiddleware: hooks?.languageModelMiddleware,
+      usageRecorder: hooks?.usageRecorder,
+      streamIdFactory: hooks?.streamIdFactory
+    },
     subagentId,
     subagentName: displayName,
-    onStepFinish: (event) => onStepFinish?.(event),
-    onCacheMetrics,
-    openAIReasoningEffort,
-    enableThinking,
-    thinkingEffort,
-    responseSchema: DiscoverySummarySchema,
-    excludeTools: ["document_app", "list_files", "grep"],
-    projectThreatModel
+    parentBus: eventBus,
+    parentSubagentId,
+    lifecycleInput: {
+      app: app.name,
+      type: "endpointDocumentation",
+      method: displayMethod,
+      path: endpoint.path
+    }
   });
   try {
-    await (agentLimiter ? agentLimiter(() => agent.consume()) : agent.consume());
-    eventBus?.emit("subagent-complete", {
-      subagentId,
-      status: "completed",
-      parentSubagentId
-    });
+    await (agentLimiter ? agentLimiter(spawnChild) : spawnChild());
     return true;
   } catch (error) {
     log3.error(`"${subagentId}" FAILED`, error instanceof Error ? error : undefined, { error: String(error) });
-    eventBus?.emit("subagent-complete", {
-      subagentId,
-      status: "failed",
-      parentSubagentId
-    });
     return false;
   }
 }
@@ -801,20 +818,18 @@ async function runAppEndpointDocumentation(opts) {
   const { endpoints, ...shared } = opts;
   if (endpoints.length === 0)
     return;
+  const spawner = opts.subagentSpawner ?? inProcessSubagentSpawner;
   let anyFailed = false;
-  await runWithBoundedConcurrency(endpoints, ENDPOINT_DOCUMENTATION_CONCURRENCY, async (endpoint) => {
+  await spawner.spawnMany(endpoints, async (endpoint) => {
     const ok = await runEndpointDocumentationAgent({ ...shared, endpoint });
     if (!ok)
       anyFailed = true;
-  });
+  }, { concurrency: ENDPOINT_DOCUMENTATION_CONCURRENCY });
   if (anyFailed) {
     throw new Error(`One or more endpoint documentation agents failed for app ${opts.app.name}`);
   }
 }
 
-// src/core/workflows/whiteboxAttackSurface.ts
-init_id();
-
 // src/core/integrations/surface/index.ts
 import { existsSync as existsSync10 } from "node:fs";
 import { dirname as dirname3, relative as relative3, resolve as resolve2, sep } from "node:path";
@@ -1073,12 +1088,12 @@ function compileMap() {
       fallback: []
     }
   }, index, length;
-  function collectType(type2) {
-    if (type2.multi) {
-      result.multi[type2.kind].push(type2);
-      result.multi["fallback"].push(type2);
+  function collectType(type) {
+    if (type.multi) {
+      result.multi[type.kind].push(type);
+      result.multi["fallback"].push(type);
     } else {
-      result[type2.kind][type2.tag] = result["fallback"][type2.tag] = type2;
+      result[type.kind][type.tag] = result["fallback"][type.tag] = type;
     }
   }
   for (index = 0, length = arguments.length;index < length; index += 1) {
@@ -1089,7 +1104,7 @@ function compileMap() {
 function Schema$1(definition) {
   return this.extend(definition);
 }
-Schema$1.prototype.extend = function extend2(definition) {
+Schema$1.prototype.extend = function extend(definition) {
   var implicit = [];
   var explicit = [];
   if (definition instanceof type) {
@@ -1496,9 +1511,9 @@ var BASE64_MAP = `ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
 function resolveYamlBinary(data) {
   if (data === null)
     return false;
-  var code, idx, bitlen = 0, max = data.length, map2 = BASE64_MAP;
+  var code, idx, bitlen = 0, max = data.length, map = BASE64_MAP;
   for (idx = 0;idx < max; idx++) {
-    code = map2.indexOf(data.charAt(idx));
+    code = map.indexOf(data.charAt(idx));
     if (code > 64)
       continue;
     if (code < 0)
@@ -1508,14 +1523,14 @@ function resolveYamlBinary(data) {
   return bitlen % 8 === 0;
 }
 function constructYamlBinary(data) {
-  var idx, tailbits, input = data.replace(/[\r\n=]/g, ""), max = input.length, map2 = BASE64_MAP, bits = 0, result = [];
+  var idx, tailbits, input = data.replace(/[\r\n=]/g, ""), max = input.length, map = BASE64_MAP, bits = 0, result = [];
   for (idx = 0;idx < max; idx++) {
     if (idx % 4 === 0 && idx) {
       result.push(bits >> 16 & 255);
       result.push(bits >> 8 & 255);
       result.push(bits & 255);
     }
-    bits = bits << 6 | map2.indexOf(input.charAt(idx));
+    bits = bits << 6 | map.indexOf(input.charAt(idx));
   }
   tailbits = max % 4 * 6;
   if (tailbits === 0) {
@@ -1531,32 +1546,32 @@ function constructYamlBinary(data) {
   return new Uint8Array(result);
 }
 function representYamlBinary(object) {
-  var result = "", bits = 0, idx, tail, max = object.length, map2 = BASE64_MAP;
+  var result = "", bits = 0, idx, tail, max = object.length, map = BASE64_MAP;
   for (idx = 0;idx < max; idx++) {
     if (idx % 3 === 0 && idx) {
-      result += map2[bits >> 18 & 63];
-      result += map2[bits >> 12 & 63];
-      result += map2[bits >> 6 & 63];
-      result += map2[bits & 63];
+      result += map[bits >> 18 & 63];
+      result += map[bits >> 12 & 63];
+      result += map[bits >> 6 & 63];
+      result += map[bits & 63];
     }
     bits = (bits << 8) + object[idx];
   }
   tail = max % 3;
   if (tail === 0) {
-    result += map2[bits >> 18 & 63];
-    result += map2[bits >> 12 & 63];
-    result += map2[bits >> 6 & 63];
-    result += map2[bits & 63];
+    result += map[bits >> 18 & 63];
+    result += map[bits >> 12 & 63];
+    result += map[bits >> 6 & 63];
+    result += map[bits & 63];
   } else if (tail === 2) {
-    result += map2[bits >> 10 & 63];
-    result += map2[bits >> 4 & 63];
-    result += map2[bits << 2 & 63];
-    result += map2[64];
+    result += map[bits >> 10 & 63];
+    result += map[bits >> 4 & 63];
+    result += map[bits << 2 & 63];
+    result += map[64];
   } else if (tail === 1) {
-    result += map2[bits >> 2 & 63];
-    result += map2[bits << 4 & 63];
-    result += map2[64];
-    result += map2[64];
+    result += map[bits >> 2 & 63];
+    result += map[bits << 4 & 63];
+    result += map[64];
+    result += map[64];
   }
   return result;
 }
@@ -1985,7 +2000,7 @@ function writeFoldedLines(state, count) {
   }
 }
 function readPlainScalar(state, nodeIndent, withinFlowCollection) {
-  var preceding, following, captureStart, captureEnd, hasPendingContent, _line, _lineStart, _lineIndent, _kind = state.kind, _result = state.result, ch;
+  var preceding, following, captureStart, captureEnd, hasPendingContent, _line, _lineStart, _lineIndent, { kind: _kind, result: _result } = state, ch;
   ch = state.input.charCodeAt(state.position);
   if (is_WS_OR_EOL(ch) || is_FLOW_INDICATOR(ch) || ch === 35 || ch === 38 || ch === 42 || ch === 33 || ch === 124 || ch === 62 || ch === 39 || ch === 34 || ch === 37 || ch === 64 || ch === 96) {
     return false;
@@ -2315,7 +2330,7 @@ function readBlockScalar(state, nodeIndent) {
   return true;
 }
 function readBlockSequence(state, nodeIndent) {
-  var _line, _tag = state.tag, _anchor = state.anchor, _result = [], following, detected = false, ch;
+  var _line, { tag: _tag, anchor: _anchor } = state, _result = [], following, detected = false, ch;
   if (state.firstTabInLine !== -1)
     return false;
   if (state.anchor !== null) {
@@ -2364,7 +2379,7 @@ function readBlockSequence(state, nodeIndent) {
   return false;
 }
 function readBlockMapping(state, nodeIndent, flowIndent) {
-  var following, allowCompact, _line, _keyLine, _keyLineStart, _keyPos, _tag = state.tag, _anchor = state.anchor, _result = {}, overridableKeys = Object.create(null), keyTag = null, keyNode = null, valueNode = null, atExplicitKey = false, detected = false, ch;
+  var following, allowCompact, _line, _keyLine, _keyLineStart, _keyPos, { tag: _tag, anchor: _anchor } = state, _result = {}, overridableKeys = Object.create(null), keyTag = null, keyNode = null, valueNode = null, atExplicitKey = false, detected = false, ch;
   if (state.firstTabInLine !== -1)
     return false;
   if (state.anchor !== null) {
@@ -2586,7 +2601,7 @@ function readAlias(state) {
   return true;
 }
 function composeNode(state, parentIndent, nodeContext, allowToSeek, allowCompact) {
-  var allowBlockStyles, allowBlockScalars, allowBlockCollections, indentStatus = 1, atNewLine = false, hasContent = false, typeIndex, typeQuantity, typeList, type2, flowIndent, blockIndent;
+  var allowBlockStyles, allowBlockScalars, allowBlockCollections, indentStatus = 1, atNewLine = false, hasContent = false, typeIndex, typeQuantity, typeList, type, flowIndent, blockIndent;
   if (state.listener !== null) {
     state.listener("open", state);
   }
@@ -2668,10 +2683,10 @@ function composeNode(state, parentIndent, nodeContext, allowToSeek, allowCompact
       throwError(state, 'unacceptable node kind for !<?> tag; it should be "scalar", not "' + state.kind + '"');
     }
     for (typeIndex = 0, typeQuantity = state.implicitTypes.length;typeIndex < typeQuantity; typeIndex += 1) {
-      type2 = state.implicitTypes[typeIndex];
-      if (type2.resolve(state.result)) {
-        state.result = type2.construct(state.result);
-        state.tag = type2.tag;
+      type = state.implicitTypes[typeIndex];
+      if (type.resolve(state.result)) {
+        state.result = type.construct(state.result);
+        state.tag = type.tag;
         if (state.anchor !== null) {
           state.anchorMap[state.anchor] = state.result;
         }
@@ -2680,27 +2695,27 @@ function composeNode(state, parentIndent, nodeContext, allowToSeek, allowCompact
     }
   } else if (state.tag !== "!") {
     if (_hasOwnProperty$1.call(state.typeMap[state.kind || "fallback"], state.tag)) {
-      type2 = state.typeMap[state.kind || "fallback"][state.tag];
+      type = state.typeMap[state.kind || "fallback"][state.tag];
     } else {
-      type2 = null;
+      type = null;
       typeList = state.typeMap.multi[state.kind || "fallback"];
       for (typeIndex = 0, typeQuantity = typeList.length;typeIndex < typeQuantity; typeIndex += 1) {
         if (state.tag.slice(0, typeList[typeIndex].tag.length) === typeList[typeIndex].tag) {
-          type2 = typeList[typeIndex];
+          type = typeList[typeIndex];
           break;
         }
       }
     }
-    if (!type2) {
+    if (!type) {
       throwError(state, "unknown tag !<" + state.tag + ">");
     }
-    if (state.result !== null && type2.kind !== state.kind) {
-      throwError(state, "unacceptable node kind for !<" + state.tag + '> tag; it should be "' + type2.kind + '", not "' + state.kind + '"');
+    if (state.result !== null && type.kind !== state.kind) {
+      throwError(state, "unacceptable node kind for !<" + state.tag + '> tag; it should be "' + type.kind + '", not "' + state.kind + '"');
     }
-    if (!type2.resolve(state.result, state.tag)) {
+    if (!type.resolve(state.result, state.tag)) {
       throwError(state, "cannot resolve a node with !<" + state.tag + "> explicit tag");
     } else {
-      state.result = type2.construct(state.result, state.tag);
+      state.result = type.construct(state.result, state.tag);
       if (state.anchor !== null) {
         state.anchorMap[state.anchor] = state.result;
       }
@@ -2904,21 +2919,21 @@ var DEPRECATED_BOOLEANS_SYNTAX = [
   "OFF"
 ];
 var DEPRECATED_BASE60_SYNTAX = /^[-+]?[0-9_]+(?::[0-9_]+)+(?:\.[0-9_]*)?$/;
-function compileStyleMap(schema2, map2) {
-  var result, keys, index, length, tag, style, type2;
-  if (map2 === null)
+function compileStyleMap(schema, map) {
+  var result, keys, index, length, tag, style, type;
+  if (map === null)
     return {};
   result = {};
-  keys = Object.keys(map2);
+  keys = Object.keys(map);
   for (index = 0, length = keys.length;index < length; index += 1) {
     tag = keys[index];
-    style = String(map2[tag]);
+    style = String(map[tag]);
     if (tag.slice(0, 2) === "!!") {
       tag = "tag:yaml.org,2002:" + tag.slice(2);
     }
-    type2 = schema2.compiledTypeMap["fallback"][tag];
-    if (type2 && _hasOwnProperty.call(type2.styleAliases, style)) {
-      style = type2.styleAliases[style];
+    type = schema.compiledTypeMap["fallback"][tag];
+    if (type && _hasOwnProperty.call(type.styleAliases, style)) {
+      style = type.styleAliases[style];
     }
     result[tag] = style;
   }
@@ -2988,11 +3003,11 @@ function generateNextLine(state, level) {
   return `
 ` + common.repeat(" ", state.indent * level);
 }
-function testImplicitResolving(state, str2) {
-  var index, length, type2;
+function testImplicitResolving(state, str) {
+  var index, length, type;
   for (index = 0, length = state.implicitTypes.length;index < length; index += 1) {
-    type2 = state.implicitTypes[index];
-    if (type2.resolve(str2)) {
+    type = state.implicitTypes[index];
+    if (type.resolve(str)) {
       return true;
     }
   }
@@ -3038,7 +3053,7 @@ var STYLE_LITERAL = 3;
 var STYLE_FOLDED = 4;
 var STYLE_DOUBLE = 5;
 function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, testAmbiguousType, quotingType, forceQuotes, inblock) {
-  var i2;
+  var i;
   var char = 0;
   var prevChar = null;
   var hasLineBreak = false;
@@ -3047,8 +3062,8 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
   var previousLineBreak = -1;
   var plain = isPlainSafeFirst(codePointAt(string, 0)) && isPlainSafeLast(codePointAt(string, string.length - 1));
   if (singleLineOnly || forceQuotes) {
-    for (i2 = 0;i2 < string.length; char >= 65536 ? i2 += 2 : i2++) {
-      char = codePointAt(string, i2);
+    for (i = 0;i < string.length; char >= 65536 ? i += 2 : i++) {
+      char = codePointAt(string, i);
       if (!isPrintable(char)) {
         return STYLE_DOUBLE;
       }
@@ -3056,13 +3071,13 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
       prevChar = char;
     }
   } else {
-    for (i2 = 0;i2 < string.length; char >= 65536 ? i2 += 2 : i2++) {
-      char = codePointAt(string, i2);
+    for (i = 0;i < string.length; char >= 65536 ? i += 2 : i++) {
+      char = codePointAt(string, i);
       if (char === CHAR_LINE_FEED) {
         hasLineBreak = true;
         if (shouldTrackWidth) {
-          hasFoldableLine = hasFoldableLine || i2 - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ";
-          previousLineBreak = i2;
+          hasFoldableLine = hasFoldableLine || i - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ";
+          previousLineBreak = i;
         }
       } else if (!isPrintable(char)) {
         return STYLE_DOUBLE;
@@ -3070,7 +3085,7 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
       plain = plain && isPlainSafe(char, prevChar, inblock);
       prevChar = char;
     }
-    hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i2 - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
+    hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
   }
   if (!hasLineBreak && !hasFoldableLine) {
     if (plain && !forceQuotes && !testAmbiguousType(string)) {
@@ -3099,8 +3114,8 @@ function writeScalar(state, string, level, iskey, inblock) {
     var indent = state.indent * Math.max(1, level);
     var lineWidth = state.lineWidth === -1 ? -1 : Math.max(Math.min(state.lineWidth, 40), state.lineWidth - indent);
     var singleLineOnly = iskey || state.flowLevel > -1 && level >= state.flowLevel;
-    function testAmbiguity(string2) {
-      return testImplicitResolving(state, string2);
+    function testAmbiguity(string) {
+      return testImplicitResolving(state, string);
     }
     switch (chooseScalarStyle(string, singleLineOnly, state.indent, lineWidth, testAmbiguity, state.quotingType, state.forceQuotes && !iskey, inblock)) {
       case STYLE_PLAIN:
@@ -3186,13 +3201,13 @@ function escapeString(string) {
   var result = "";
   var char = 0;
   var escapeSeq;
-  for (var i2 = 0;i2 < string.length; char >= 65536 ? i2 += 2 : i2++) {
-    char = codePointAt(string, i2);
+  for (var i = 0;i < string.length; char >= 65536 ? i += 2 : i++) {
+    char = codePointAt(string, i);
     escapeSeq = ESCAPE_SEQUENCES[char];
     if (!escapeSeq && isPrintable(char)) {
-      result += string[i2];
+      result += string[i];
       if (char >= 65536)
-        result += string[i2 + 1];
+        result += string[i + 1];
     } else {
       result += escapeSeq || encodeHex(char);
     }
@@ -3314,28 +3329,28 @@ function writeBlockMapping(state, level, object, compact) {
   state.dump = _result || "{}";
 }
 function detectType(state, object, explicit) {
-  var _result, typeList, index, length, type2, style;
+  var _result, typeList, index, length, type, style;
   typeList = explicit ? state.explicitTypes : state.implicitTypes;
   for (index = 0, length = typeList.length;index < length; index += 1) {
-    type2 = typeList[index];
-    if ((type2.instanceOf || type2.predicate) && (!type2.instanceOf || typeof object === "object" && object instanceof type2.instanceOf) && (!type2.predicate || type2.predicate(object))) {
+    type = typeList[index];
+    if ((type.instanceOf || type.predicate) && (!type.instanceOf || typeof object === "object" && object instanceof type.instanceOf) && (!type.predicate || type.predicate(object))) {
       if (explicit) {
-        if (type2.multi && type2.representName) {
-          state.tag = type2.representName(object);
+        if (type.multi && type.representName) {
+          state.tag = type.representName(object);
         } else {
-          state.tag = type2.tag;
+          state.tag = type.tag;
         }
       } else {
         state.tag = "?";
       }
-      if (type2.represent) {
-        style = state.styleMap[type2.tag] || type2.defaultStyle;
-        if (_toString.call(type2.represent) === "[object Function]") {
-          _result = type2.represent(object, style);
-        } else if (_hasOwnProperty.call(type2.represent, style)) {
-          _result = type2.represent[style](object, style);
+      if (type.represent) {
+        style = state.styleMap[type.tag] || type.defaultStyle;
+        if (_toString.call(type.represent) === "[object Function]") {
+          _result = type.represent(object, style);
+        } else if (_hasOwnProperty.call(type.represent, style)) {
+          _result = type.represent[style](object, style);
         } else {
-          throw new exception("!<" + type2.tag + '> tag resolver accepts not "' + style + '" style');
+          throw new exception("!<" + type.tag + '> tag resolver accepts not "' + style + '" style');
         }
         state.dump = _result;
       }
@@ -3350,13 +3365,13 @@ function writeNode(state, level, object, block, compact, iskey, isblockseq) {
   if (!detectType(state, object, false)) {
     detectType(state, object, true);
   }
-  var type2 = _toString.call(state.dump);
+  var type = _toString.call(state.dump);
   var inblock = block;
   var tagStr;
   if (block) {
     block = state.flowLevel < 0 || state.flowLevel > level;
   }
-  var objectOrArray = type2 === "[object Object]" || type2 === "[object Array]", duplicateIndex, duplicate;
+  var objectOrArray = type === "[object Object]" || type === "[object Array]", duplicateIndex, duplicate;
   if (objectOrArray) {
     duplicateIndex = state.duplicates.indexOf(object);
     duplicate = duplicateIndex !== -1;
@@ -3370,7 +3385,7 @@ function writeNode(state, level, object, block, compact, iskey, isblockseq) {
     if (objectOrArray && duplicate && !state.usedDuplicates[duplicateIndex]) {
       state.usedDuplicates[duplicateIndex] = true;
     }
-    if (type2 === "[object Object]") {
+    if (type === "[object Object]") {
       if (block && Object.keys(state.dump).length !== 0) {
         writeBlockMapping(state, level, state.dump, compact);
         if (duplicate) {
@@ -3382,7 +3397,7 @@ function writeNode(state, level, object, block, compact, iskey, isblockseq) {
           state.dump = "&ref_" + duplicateIndex + " " + state.dump;
         }
       }
-    } else if (type2 === "[object Array]") {
+    } else if (type === "[object Array]") {
       if (block && state.dump.length !== 0) {
         if (state.noArrayIndent && !isblockseq && level > 0) {
           writeBlockSequence(state, level - 1, state.dump, compact);
@@ -3398,16 +3413,16 @@ function writeNode(state, level, object, block, compact, iskey, isblockseq) {
           state.dump = "&ref_" + duplicateIndex + " " + state.dump;
         }
       }
-    } else if (type2 === "[object String]") {
+    } else if (type === "[object String]") {
       if (state.tag !== "?") {
         writeScalar(state, state.dump, level, iskey, inblock);
       }
-    } else if (type2 === "[object Undefined]") {
+    } else if (type === "[object Undefined]") {
       return false;
     } else {
       if (state.skipInvalid)
         return false;
-      throw new exception("unacceptable kind of an object to dump " + type2);
+      throw new exception("unacceptable kind of an object to dump " + type);
     }
     if (state.tag !== null && state.tag !== "?") {
       tagStr = encodeURI(state.tag[0] === "!" ? state.tag.slice(1) : state.tag).replace(/!/g, "%21");
@@ -3838,8 +3853,8 @@ function normalizePath(path) {
 }
 function lineNumber(content, offset) {
   let count = 1;
-  for (let i2 = 0;i2 < offset && i2 < content.length; i2++) {
-    if (content[i2] === `
+  for (let i = 0;i < offset && i < content.length; i++) {
+    if (content[i] === `
 `)
       count++;
   }
@@ -3847,10 +3862,10 @@ function lineNumber(content, offset) {
 }
 function buildLineIndex(content) {
   const offsets = [0];
-  for (let i2 = 0;i2 < content.length; i2++) {
-    if (content[i2] === `
+  for (let i = 0;i < content.length; i++) {
+    if (content[i] === `
 `)
-      offsets.push(i2 + 1);
+      offsets.push(i + 1);
   }
   return {
     lineAt(offset) {
@@ -4065,8 +4080,8 @@ var django = {
     const pyFiles = ctx.iterFiles(PY_EXTS3);
     const dirOf2 = (f) => {
       const norm = f.replace(/\\/g, "/");
-      const i2 = norm.lastIndexOf("/");
-      return i2 < 0 ? "" : norm.slice(0, i2);
+      const i = norm.lastIndexOf("/");
+      return i < 0 ? "" : norm.slice(0, i);
     };
     const classesByDir = /* @__PURE__ */ new Map;
     const funcsByDir = /* @__PURE__ */ new Map;
@@ -4260,67 +4275,67 @@ var PAGE_RENDER_RE = /\bres\s*\.\s*render\s*\(/;
 var PAGE_SENDFILE_RE = /\bres\s*\.\s*sendFile\s*\(/;
 function findMatchingParen(content, start) {
   let depth = 0;
-  let i2 = start;
+  let i = start;
   const len = content.length;
-  while (i2 < len) {
-    const ch = content[i2];
-    if (ch === "/" && content[i2 + 1] === "/") {
+  while (i < len) {
+    const ch = content[i];
+    if (ch === "/" && content[i + 1] === "/") {
       const nl = content.indexOf(`
-`, i2);
+`, i);
       if (nl === -1)
         return -1;
-      i2 = nl + 1;
+      i = nl + 1;
       continue;
     }
-    if (ch === "/" && content[i2 + 1] === "*") {
-      const end = content.indexOf("*/", i2 + 2);
+    if (ch === "/" && content[i + 1] === "*") {
+      const end = content.indexOf("*/", i + 2);
       if (end === -1)
         return -1;
-      i2 = end + 2;
+      i = end + 2;
       continue;
     }
     if (ch === "'" || ch === '"') {
-      i2++;
-      while (i2 < len) {
-        const c = content[i2];
+      i++;
+      while (i < len) {
+        const c = content[i];
         if (c === "\\") {
-          i2 += 2;
+          i += 2;
           continue;
         }
         if (c === ch) {
-          i2++;
+          i++;
           break;
         }
-        i2++;
+        i++;
       }
       continue;
     }
     if (ch === "`") {
-      i2++;
-      while (i2 < len) {
-        const c = content[i2];
+      i++;
+      while (i < len) {
+        const c = content[i];
         if (c === "\\") {
-          i2 += 2;
+          i += 2;
           continue;
         }
         if (c === "`") {
-          i2++;
+          i++;
           break;
         }
-        if (c === "$" && content[i2 + 1] === "{") {
-          i2 += 2;
+        if (c === "$" && content[i + 1] === "{") {
+          i += 2;
           let d = 1;
-          while (i2 < len && d > 0) {
-            const cc = content[i2];
+          while (i < len && d > 0) {
+            const cc = content[i];
             if (cc === "{")
               d++;
             else if (cc === "}")
               d--;
-            i2++;
+            i++;
           }
           continue;
         }
-        i2++;
+        i++;
       }
       continue;
     }
@@ -4329,9 +4344,9 @@ function findMatchingParen(content, start) {
     else if (ch === ")" || ch === "]" || ch === "}") {
       depth--;
       if (depth === 0 && ch === ")")
-        return i2;
+        return i;
     }
-    i2++;
+    i++;
   }
   return -1;
 }
@@ -4492,47 +4507,47 @@ var express = {
 };
 function maskComments(src) {
   let out = "";
-  let i2 = 0;
+  let i = 0;
   const n = src.length;
-  while (i2 < n) {
-    const c = src[i2];
+  while (i < n) {
+    const c = src[i];
     if (c === '"' || c === "'" || c === "`") {
       out += c;
-      i2++;
-      while (i2 < n) {
-        if (src[i2] === "\\" && i2 + 1 < n) {
-          out += src[i2] + src[i2 + 1];
-          i2 += 2;
+      i++;
+      while (i < n) {
+        if (src[i] === "\\" && i + 1 < n) {
+          out += src[i] + src[i + 1];
+          i += 2;
           continue;
         }
-        out += src[i2];
-        const done = src[i2] === c;
-        i2++;
+        out += src[i];
+        const done = src[i] === c;
+        i++;
         if (done)
           break;
       }
-    } else if (c === "/" && src[i2 + 1] === "/") {
-      while (i2 < n && src[i2] !== `
+    } else if (c === "/" && src[i + 1] === "/") {
+      while (i < n && src[i] !== `
 `) {
         out += " ";
-        i2++;
+        i++;
       }
-    } else if (c === "/" && src[i2 + 1] === "*") {
+    } else if (c === "/" && src[i + 1] === "*") {
       out += "  ";
-      i2 += 2;
-      while (i2 < n && !(src[i2] === "*" && src[i2 + 1] === "/")) {
-        out += src[i2] === `
+      i += 2;
+      while (i < n && !(src[i] === "*" && src[i + 1] === "/")) {
+        out += src[i] === `
 ` ? `
 ` : " ";
-        i2++;
+        i++;
       }
-      if (i2 < n) {
+      if (i < n) {
         out += "  ";
-        i2 += 2;
+        i += 2;
       }
     } else {
       out += c;
-      i2++;
+      i++;
     }
   }
   return out;
@@ -4995,8 +5010,8 @@ var GO_EXTS = [".go"];
 var GO_GROUP_RE = /(\w+)\s*[:=]+\s*(\w+)\.Group\s*\(\s*['"]([^'"]+)['"]/g;
 var dirOf = (f) => {
   const norm = f.replace(/\\/g, "/");
-  const i2 = norm.lastIndexOf("/");
-  return i2 < 0 ? "" : norm.slice(0, i2);
+  const i = norm.lastIndexOf("/");
+  return i < 0 ? "" : norm.slice(0, i);
 };
 var GORILLA_WS_IMPORT_RE = /["']github\.com\/gorilla\/websocket["']/;
 var UPGRADE_CALL_RE = /\.\s*Upgrade\s*\(/;
@@ -5010,26 +5025,26 @@ function findWebsocketHandlers(ctx, goFiles) {
     if (!GORILLA_WS_IMPORT_RE.test(content))
       continue;
     const dir = dirOf(f);
-    const set2 = byDir.get(dir) ?? /* @__PURE__ */ new Set;
+    const set = byDir.get(dir) ?? /* @__PURE__ */ new Set;
     for (const m of content.matchAll(funcRe)) {
       const name = m[1];
       const bodyStart = m.index + m[0].length;
       let depth = 1;
-      let i2 = bodyStart;
+      let i = bodyStart;
       const len = content.length;
-      while (i2 < len && depth > 0) {
-        const ch = content[i2];
+      while (i < len && depth > 0) {
+        const ch = content[i];
         if (ch === "{")
           depth++;
         else if (ch === "}")
           depth--;
-        i2++;
+        i++;
       }
-      const body = content.slice(bodyStart, i2 - 1);
+      const body = content.slice(bodyStart, i - 1);
       if (UPGRADE_CALL_RE.test(body))
-        set2.add(name);
+        set.add(name);
     }
-    byDir.set(dir, set2);
+    byDir.set(dir, set);
   }
   return byDir;
 }
@@ -5410,8 +5425,8 @@ var rails = {
     const nsStack = [];
     let depth = 0;
     const prefixAtLine = new Array(sourceLines.length + 1).fill("");
-    for (let i2 = 0;i2 < sourceLines.length; i2++) {
-      const line = sourceLines[i2];
+    for (let i = 0;i < sourceLines.length; i++) {
+      const line = sourceLines[i];
       const code = line.replace(/#.*$/, "");
       const nsM = namespaceLineRe.exec(code);
       if (nsM) {
@@ -5428,7 +5443,7 @@ var rails = {
       if (doMatches)
         depth++;
       const prefix = nsStack.length ? "/" + nsStack.map((n) => n.name).join("/") : "";
-      prefixAtLine[i2 + 1] = prefix;
+      prefixAtLine[i + 1] = prefix;
     }
     const prefixAt = (offset) => {
       const ln = lines.lineAt(offset);
@@ -5696,15 +5711,15 @@ function splitTopLevel(s) {
   const parts = [];
   let depth = 0;
   let start = 0;
-  for (let i2 = 0;i2 < s.length; i2++) {
-    const c = s[i2];
+  for (let i = 0;i < s.length; i++) {
+    const c = s[i];
     if (c === "<" || c === "{" || c === "[" || c === "(")
       depth++;
     else if (c === ">" || c === "}" || c === "]" || c === ")")
       depth--;
     else if (c === "," && depth === 0) {
-      parts.push(s.slice(start, i2));
-      start = i2 + 1;
+      parts.push(s.slice(start, i));
+      start = i + 1;
     }
   }
   parts.push(s.slice(start));
@@ -5712,14 +5727,14 @@ function splitTopLevel(s) {
 }
 function findTopLevelChar(s, targets) {
   let depth = 0;
-  for (let i2 = 0;i2 < s.length; i2++) {
-    const c = s[i2];
+  for (let i = 0;i < s.length; i++) {
+    const c = s[i];
     if (c === "<" || c === "{" || c === "[" || c === "(")
       depth++;
     else if (c === ">" || c === "}" || c === "]" || c === ")")
       depth--;
     else if (depth === 0 && targets.includes(c))
-      return i2;
+      return i;
   }
   return -1;
 }
@@ -5743,14 +5758,14 @@ function parseParams(funcParams) {
     if (trimmed.startsWith("{")) {
       let depth = 0;
       let close = -1;
-      for (let i2 = 0;i2 < trimmed.length; i2++) {
-        const c = trimmed[i2];
+      for (let i = 0;i < trimmed.length; i++) {
+        const c = trimmed[i];
         if (c === "{")
           depth++;
         else if (c === "}") {
           depth--;
           if (depth === 0) {
-            close = i2;
+            close = i;
             break;
           }
         }
@@ -5882,11 +5897,11 @@ var openapi = {
           for (const p of allParams) {
             if (!p || typeof p !== "object")
               continue;
-            const schema2 = p.schema;
+            const schema = p.schema;
             params.push({
               name: p.name ?? "?",
               location: p.in ?? "query",
-              type: schema2?.type,
+              type: schema?.type,
               required: p.required ?? false
             });
           }
@@ -5955,46 +5970,46 @@ function makeConnectResolver(ctx) {
 }
 function stripComments(src) {
   let out = "";
-  for (let i2 = 0;i2 < src.length; ) {
-    const c = src[i2];
+  for (let i = 0;i < src.length; ) {
+    const c = src[i];
     if (c === '"' || c === "'") {
       out += c;
-      i2++;
-      while (i2 < src.length && src[i2] !== c) {
-        if (src[i2] === "\\" && i2 + 1 < src.length) {
-          out += src[i2] + src[i2 + 1];
-          i2 += 2;
+      i++;
+      while (i < src.length && src[i] !== c) {
+        if (src[i] === "\\" && i + 1 < src.length) {
+          out += src[i] + src[i + 1];
+          i += 2;
         } else {
-          out += src[i2];
-          i2++;
+          out += src[i];
+          i++;
         }
       }
-      if (i2 < src.length) {
-        out += src[i2];
-        i2++;
+      if (i < src.length) {
+        out += src[i];
+        i++;
       }
-    } else if (c === "/" && src[i2 + 1] === "/") {
-      while (i2 < src.length && src[i2] !== `
+    } else if (c === "/" && src[i + 1] === "/") {
+      while (i < src.length && src[i] !== `
 `) {
         out += " ";
-        i2++;
+        i++;
       }
-    } else if (c === "/" && src[i2 + 1] === "*") {
+    } else if (c === "/" && src[i + 1] === "*") {
       out += "  ";
-      i2 += 2;
-      while (i2 < src.length && !(src[i2] === "*" && src[i2 + 1] === "/")) {
-        out += src[i2] === `
+      i += 2;
+      while (i < src.length && !(src[i] === "*" && src[i + 1] === "/")) {
+        out += src[i] === `
 ` ? `
 ` : " ";
-        i2++;
+        i++;
       }
-      if (i2 < src.length) {
+      if (i < src.length) {
         out += "  ";
-        i2 += 2;
+        i += 2;
       }
     } else {
       out += c;
-      i2++;
+      i++;
     }
   }
   return out;
@@ -6123,33 +6138,33 @@ function inferServiceType(absDir) {
   try {
     const content = readFileSync42(join10(absDir, "package.json"), "utf-8");
     const lower = content.toLowerCase();
-    for (const [dep, type2] of PKG_DEP_TO_TYPE) {
+    for (const [dep, type] of PKG_DEP_TO_TYPE) {
       if (lower.includes(`"${dep}"`))
-        return type2;
+        return type;
     }
     return "generic";
   } catch {}
   try {
     const content = readFileSync42(join10(absDir, "go.mod"), "utf-8");
-    for (const [dep, type2] of GO_DEP_TO_TYPE) {
+    for (const [dep, type] of GO_DEP_TO_TYPE) {
       if (content.includes(dep))
-        return type2;
+        return type;
     }
     return "generic";
   } catch {}
   try {
     const content = readFileSync42(join10(absDir, "Cargo.toml"), "utf-8");
-    for (const [dep, type2] of CARGO_DEP_TO_TYPE) {
+    for (const [dep, type] of CARGO_DEP_TO_TYPE) {
       if (content.includes(dep))
-        return type2;
+        return type;
     }
     return "generic";
   } catch {}
   try {
     const content = readFileSync42(join10(absDir, "requirements.txt"), "utf-8");
-    for (const [dep, type2] of PY_DEP_TO_TYPE) {
+    for (const [dep, type] of PY_DEP_TO_TYPE) {
       if (content.includes(dep))
-        return type2;
+        return type;
     }
     return "generic";
   } catch {}
@@ -6965,10 +6980,10 @@ function mapAppWithSurface(appPath, repoRoot, options) {
   }
   const narrow = map2(absApp, { includeInternal: false });
   if (narrow.frameworks.length > 0 && narrow.endpoints.all.length > 0) {
-    const rebased2 = rebaseFileToRepoRoot(narrow.endpoints.all, absApp, absRoot);
+    const rebased = rebaseFileToRepoRoot(narrow.endpoints.all, absApp, absRoot);
     return {
       mode: "surface",
-      endpoints: consolidateBySameRoute(rebased2),
+      endpoints: consolidateBySameRoute(rebased),
       frameworks: narrow.frameworks
     };
   }
@@ -7006,6 +7021,7 @@ var TASK_TYPE_LABELS = {
   apiEndpoints: "API Endpoints",
   cloudResourceEndpoints: "Cloud Resources"
 };
+var NON_SERVICE_TYPES = ["cloud_resource", "storage", "database"];
 function sanitizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9-_.]/g, "_");
 }
@@ -7018,6 +7034,129 @@ function toAppMetadata(app) {
     location: app.location
   };
 }
+async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
+  const {
+    codebasePath,
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    eventBus,
+    attackSurfaceRegistry,
+    onStepFinish,
+    onCacheMetrics,
+    openAIReasoningEffort,
+    enableThinking,
+    thinkingEffort,
+    projectThreatModel,
+    environments,
+    surfaceIntegrationEnabled,
+    isSingleAppRepo,
+    umbrellaId,
+    mintChildId,
+    agentLimiter,
+    subagentSpawner,
+    hooks: sharedHooks,
+    seams
+  } = input;
+  const appNodeId = `app:${sanitizeName(app.name)}`;
+  const hooksForApp = resolveItemHooks(sharedHooks, seams, app, appIndex);
+  let failed = false;
+  const spawnDiscoveryAgent = async (type, objective) => {
+    const subagentId = mintChildId(TASK_TYPE_LABELS[type]);
+    log4.debug(`Phase 2: spawning agent id="${subagentId}" parent="${appNodeId}" (app="${app.name}", type=${type}, appType=${app.type})`);
+    const spawner = subagentSpawner ?? inProcessSubagentSpawner;
+    try {
+      await agentLimiter(() => spawner.spawn({
+        spec: {
+          type: "code",
+          codebasePath,
+          objective,
+          system: WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
+          excludeTools: ["document_app"],
+          responseSchema: DiscoverySummarySchema2,
+          projectThreatModel,
+          attackSurfaceRegistry
+        },
+        runtime: {
+          model,
+          session,
+          authConfig,
+          abortSignal,
+          enableThinking,
+          thinkingEffort,
+          openAIReasoningEffort,
+          onStepFinish,
+          onCacheMetrics,
+          backends: hooksForApp.backends,
+          sandbox: hooksForApp.sandbox,
+          languageModelMiddleware: hooksForApp.languageModelMiddleware,
+          usageRecorder: hooksForApp.usageRecorder,
+          streamIdFactory: hooksForApp.streamIdFactory
+        },
+        subagentId,
+        subagentName: TASK_TYPE_LABELS[type],
+        parentBus: eventBus,
+        parentSubagentId: appNodeId,
+        lifecycleInput: { app: app.name, type }
+      }));
+      log4.debug(`Phase 2: agent "${subagentId}" completed`);
+    } catch (error) {
+      log4.error(`Phase 2: agent "${subagentId}" FAILED`, error instanceof Error ? error : undefined, { error: String(error) });
+      failed = true;
+    }
+  };
+  const spawnPagesAgent = () => spawnDiscoveryAgent("pages", buildPagesDiscoveryObjective(codebasePath, app));
+  const spawnApiEndpointsAgent = () => spawnDiscoveryAgent("apiEndpoints", buildApiEndpointsDiscoveryObjective(codebasePath, app));
+  const spawnCloudResourceAgent = () => spawnDiscoveryAgent("cloudResourceEndpoints", buildCloudResourceEndpointsObjective(codebasePath, app, environments));
+  try {
+    if (NON_SERVICE_TYPES.includes(app.type)) {
+      await spawnCloudResourceAgent();
+    } else if (!surfaceIntegrationEnabled) {
+      log4.debug(`${app.name}: legacy (surfaceIntegrationEnabled=false)`);
+      await Promise.all([spawnPagesAgent(), spawnApiEndpointsAgent()]);
+    } else {
+      const surfaceResult = mapAppWithSurface(join16(codebasePath, app.location), codebasePath, { isSingleAppRepo });
+      if (surfaceResult.mode === "surface") {
+        log4.debug(`${app.name}: surface-driven (${surfaceResult.endpoints.length} endpoints, frameworks=${surfaceResult.frameworks.join(",")})`);
+        await runAppEndpointDocumentation({
+          codebasePath,
+          app,
+          endpoints: surfaceResult.endpoints,
+          frameworks: surfaceResult.frameworks,
+          model,
+          session,
+          authConfig,
+          abortSignal,
+          eventBus,
+          attackSurfaceRegistry,
+          onStepFinish,
+          onCacheMetrics,
+          openAIReasoningEffort,
+          enableThinking,
+          thinkingEffort,
+          projectThreatModel,
+          parentSubagentId: appNodeId,
+          agentLimiter,
+          subagentSpawner,
+          hooks: hooksForApp,
+          mintChildId
+        });
+      } else {
+        log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);
+        await Promise.all([spawnPagesAgent(), spawnApiEndpointsAgent()]);
+      }
+    }
+  } catch {
+    failed = true;
+  }
+  eventBus?.emit("subagent-complete", {
+    subagentId: appNodeId,
+    status: failed ? "failed" : "completed",
+    parentSubagentId: umbrellaId
+  });
+  return failed;
+}
 async function runWhiteboxAttackSurfaceWorkflow(input) {
   const {
     codebasePath,
@@ -7036,19 +7175,28 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     projectThreatModel,
     environments,
     surfaceIntegrationEnabled = true,
-    maxConcurrentAgents = MAX_CONCURRENT_AGENTS
+    maxConcurrentAgents = MAX_CONCURRENT_AGENTS,
+    subagentSpawner,
+    hooks,
+    seams: inputSeams
   } = input;
+  const seams = inputSeams ?? inProcessSeams();
+  const sharedHooks = { subagentSpawner, ...hooks };
+  let nextChildOrdinal = 0;
+  const mintChildId = (name) => seams.ids.newSessionId(name, nextChildOrdinal++);
   const agentSlots = pLimit(Math.max(1, maxConcurrentAgents));
   const agentLimiter = (fn) => agentSlots(fn);
-  const WORKFLOW_UMBRELLA_ID = newSessionId();
-  const appsAgent = new CodeAgent({
+  const WORKFLOW_UMBRELLA_ID = mintChildId("whitebox-apps-discovery");
+  if (input.incremental && !hooks?.backends)
+    throw new Error("Incremental recon requires owned artifact backends");
+  const appsAgent = new CodeAgent2({
     codebasePath,
-    objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
-    system: WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+    objective: input.incremental ? buildIncrementalObjective(codebasePath, input.incremental.diffPath, input.incremental.assetsPath, input.incremental.existingResult, domains, environments).replace("- **Non-route changes** (e.g. utility functions, configs, tests) → skip", "- **Shared-library/configuration changes** → trace affected consumers and update only impacted endpoint assets; skip unrelated changes") + `
+Trace changed shared libraries, deleted files, and root/build/deployment configuration to the applications that consume them. A path outside an application directory does not prove that application is unaffected. Leave unrelated endpoint artifacts unchanged.` : buildAppsDiscoveryObjective(codebasePath, domains, environments),
+    system: input.incremental ? WHITEBOX_DISCOVERY_SYSTEM_PROMPT2 : WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
     model,
     session,
     authConfig,
-    abortSignal,
     attackSurfaceRegistry,
     eventBus,
     subagentId: WORKFLOW_UMBRELLA_ID,
@@ -7058,9 +7206,12 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     openAIReasoningEffort,
     enableThinking,
     thinkingEffort,
-    responseSchema: AppsDiscoveryResultSchema,
+    responseSchema: input.incremental ? IncrementalReconResultSchema : AppsDiscoveryResultSchema2,
     projectThreatModel,
-    excludeTools: ["document_endpoint"]
+    excludeTools: input.incremental ? [] : ["document_endpoint"],
+    ...sharedHooks,
+    ...input.incremental ? { attackSurfaceArtifactsPath: input.incremental.assetsPath } : {},
+    abortSignal
   });
   log4.info(`Phase 1: discovering apps in ${codebasePath}${domains?.length ? ` (${domains.length} known domains)` : ""}`);
   eventBus?.emit("subagent-spawn", {
@@ -7069,6 +7220,16 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     input: { codebasePath }
   });
   const appsResult = await agentLimiter(() => appsAgent.consume());
+  if (input.incremental) {
+    if (!hooks?.backends)
+      throw new Error("Incremental recon requires owned artifact backends");
+    const result = await readIncrementalReconAssets(hooks.backends, input.incremental.assetsPath, input.incremental.existingResult, abortSignal);
+    eventBus?.emit("subagent-complete", {
+      subagentId: WORKFLOW_UMBRELLA_ID,
+      status: "completed"
+    });
+    return result;
+  }
   log4.info(`Phase 1 complete: ${appsResult?.apps.length ?? 0} apps discovered` + (appsResult ? ` (repoType=${appsResult.repoType}, packageManager=${appsResult.packageManager})` : " (no result returned)"));
   if (appsResult?.apps.length) {
     for (const app of appsResult.apps) {
@@ -7100,7 +7261,6 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     writeFileSync3(join16(appDir, "app.json"), JSON.stringify(toAppMetadata(app), null, 2), "utf-8");
   }
   log4.info(`Phase 2: surfaceIntegrationEnabled=${surfaceIntegrationEnabled}`);
-  const NON_SERVICE_TYPES = ["cloud_resource", "storage", "database"];
   const serviceApps = appsResult.apps.filter((app) => !NON_SERVICE_TYPES.includes(app.type));
   const cloudApps = appsResult.apps.filter((app) => NON_SERVICE_TYPES.includes(app.type));
   log4.info(`Phase 2: ${serviceApps.length} service apps (surface or fallback per app), ${cloudApps.length} cloud resources → ${appsResult.apps.length} total apps`);
@@ -7110,130 +7270,48 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     totalApps,
     completedApps: 0
   });
-  const appNodeIdFor = (appName) => `app:${sanitizeName(appName)}`;
-  const appAnyTaskFailed = new Map;
   for (const app of appsResult.apps) {
-    const appNodeId = appNodeIdFor(app.name);
-    appAnyTaskFailed.set(app.name, false);
     eventBus?.emit("subagent-spawn", {
-      subagentId: appNodeId,
+      subagentId: `app:${sanitizeName(app.name)}`,
       name: app.name,
       input: { app: app.name, type: app.type, framework: app.framework },
       parentSubagentId: WORKFLOW_UMBRELLA_ID
     });
   }
-  const spawnDiscoveryAgent = async (app, type2, objective) => {
-    const subagentId = newSessionId();
-    const appNodeId = appNodeIdFor(app.name);
-    log4.debug(`Phase 2: spawning agent id="${subagentId}" parent="${appNodeId}" (app="${app.name}", type=${type2}, appType=${app.type})`);
-    eventBus?.emit("subagent-spawn", {
-      subagentId,
-      name: TASK_TYPE_LABELS[type2],
-      input: { app: app.name, type: type2 },
-      parentSubagentId: appNodeId
-    });
-    const agent = new CodeAgent({
-      codebasePath,
-      objective,
-      system: WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
-      model,
-      session,
-      authConfig,
-      abortSignal,
-      attackSurfaceRegistry,
-      eventBus,
-      subagentId,
-      subagentName: TASK_TYPE_LABELS[type2],
-      onStepFinish: (event) => onStepFinish?.(event),
-      onCacheMetrics,
-      openAIReasoningEffort,
-      enableThinking,
-      thinkingEffort,
-      responseSchema: DiscoverySummarySchema,
-      excludeTools: ["document_app"],
-      projectThreatModel
-    });
-    try {
-      await agentLimiter(() => agent.consume());
-      log4.debug(`Phase 2: agent "${subagentId}" completed`);
-      eventBus?.emit("subagent-complete", {
-        subagentId,
-        status: "completed",
-        parentSubagentId: appNodeId
-      });
-    } catch (error) {
-      log4.error(`Phase 2: agent "${subagentId}" FAILED`, error instanceof Error ? error : undefined, { error: String(error) });
-      appAnyTaskFailed.set(app.name, true);
-      eventBus?.emit("subagent-complete", {
-        subagentId,
-        status: "failed",
-        parentSubagentId: appNodeId
-      });
-    }
+  const appWorkerInput = {
+    codebasePath,
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    eventBus,
+    attackSurfaceRegistry,
+    onStepFinish,
+    onCacheMetrics,
+    openAIReasoningEffort,
+    enableThinking,
+    thinkingEffort,
+    projectThreatModel,
+    environments,
+    surfaceIntegrationEnabled,
+    isSingleAppRepo: serviceApps.length === 1,
+    umbrellaId: WORKFLOW_UMBRELLA_ID,
+    mintChildId,
+    agentLimiter,
+    subagentSpawner,
+    hooks: sharedHooks,
+    seams
   };
-  const spawnPagesAgent = (app) => spawnDiscoveryAgent(app, "pages", buildPagesDiscoveryObjective(codebasePath, app));
-  const spawnApiEndpointsAgent = (app) => spawnDiscoveryAgent(app, "apiEndpoints", buildApiEndpointsDiscoveryObjective(codebasePath, app));
-  const spawnCloudResourceAgent = (app) => spawnDiscoveryAgent(app, "cloudResourceEndpoints", buildCloudResourceEndpointsObjective(codebasePath, app, environments));
-  await runWithBoundedConcurrency(appsResult.apps, DEFAULT_CONCURRENCY, async (app) => {
-    const appNodeId = appNodeIdFor(app.name);
-    try {
-      if (NON_SERVICE_TYPES.includes(app.type)) {
-        await spawnCloudResourceAgent(app);
-      } else if (!surfaceIntegrationEnabled) {
-        log4.debug(`${app.name}: legacy (surfaceIntegrationEnabled=false)`);
-        await Promise.all([
-          spawnPagesAgent(app),
-          spawnApiEndpointsAgent(app)
-        ]);
-      } else {
-        const surfaceResult = mapAppWithSurface(join16(codebasePath, app.location), codebasePath, { isSingleAppRepo: serviceApps.length === 1 });
-        if (surfaceResult.mode === "surface") {
-          log4.debug(`${app.name}: surface-driven (${surfaceResult.endpoints.length} endpoints, frameworks=${surfaceResult.frameworks.join(",")})`);
-          await runAppEndpointDocumentation({
-            codebasePath,
-            app,
-            endpoints: surfaceResult.endpoints,
-            frameworks: surfaceResult.frameworks,
-            model,
-            session,
-            authConfig,
-            abortSignal,
-            eventBus,
-            attackSurfaceRegistry,
-            onStepFinish,
-            onCacheMetrics,
-            openAIReasoningEffort,
-            enableThinking,
-            thinkingEffort,
-            projectThreatModel,
-            parentSubagentId: appNodeId,
-            agentLimiter
-          });
-        } else {
-          log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);
-          await Promise.all([
-            spawnPagesAgent(app),
-            spawnApiEndpointsAgent(app)
-          ]);
-        }
-      }
-    } catch {
-      appAnyTaskFailed.set(app.name, true);
-    } finally {
-      completedAppCount++;
-      const appStatus = appAnyTaskFailed.get(app.name) ? "failed" : "completed";
-      eventBus?.emit("subagent-complete", {
-        subagentId: appNodeId,
-        status: appStatus,
-        parentSubagentId: WORKFLOW_UMBRELLA_ID
-      });
-      eventBus?.emit("app-analysis-progress", {
-        totalApps,
-        completedApps: completedAppCount,
-        appName: app.name
-      });
-    }
-  });
+  assertDepth(1, seams.limits);
+  await seams.fanOut.spawnMany(appsResult.apps, async (app, appIndex) => {
+    await runWhiteboxAttackSurfaceApp(app, appIndex, appWorkerInput);
+    completedAppCount++;
+    eventBus?.emit("app-analysis-progress", {
+      totalApps,
+      completedApps: completedAppCount,
+      appName: app.name
+    });
+  }, { concurrency: DEFAULT_CONCURRENCY });
   eventBus?.emit("subagent-complete", {
     subagentId: WORKFLOW_UMBRELLA_ID,
     status: "completed"
@@ -7266,7 +7344,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
 function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
   const repoType = appsDiscovery?.repoType ?? "unknown";
   const packageManager = appsDiscovery?.packageManager ?? "unknown";
-  if (!existsSync12(assetsPath)) {
+  if (!existsSync11(assetsPath)) {
     log4.debug(`readAssets: assets directory does not exist: ${assetsPath}`);
     return { apps: [], repoType, packageManager };
   }
@@ -7281,7 +7359,7 @@ function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
     }
     const appJsonPath = join16(entryPath, "app.json");
     let metadata;
-    if (existsSync12(appJsonPath)) {
+    if (existsSync11(appJsonPath)) {
       try {
         metadata = JSON.parse(readFileSync9(appJsonPath, "utf-8"));
       } catch {
@@ -7301,16 +7379,16 @@ function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
       try {
         const raw = readFileSync9(join16(entryPath, file), "utf-8");
         const data = JSON.parse(raw);
-        const endpoint2 = assetRecordToEndpoint(data);
-        if (!endpoint2) {
+        const endpoint = assetRecordToEndpoint(data);
+        if (!endpoint) {
           log4.debug(`readAssets: ${file}: failed schema validation (assetRecordToEndpoint returned null)`);
           parseFailed++;
           continue;
         }
         if (isPageEndpoint(data)) {
-          pages.push(endpoint2);
+          pages.push(endpoint);
         } else {
-          apiEndpoints.push(endpoint2);
+          apiEndpoints.push(endpoint);
         }
       } catch {
         log4.warn(`readAssets: skipping unreadable asset file: ${entry}/${file}`);
@@ -7335,7 +7413,7 @@ function assetRecordToEndpoint(record) {
   const method = Array.isArray(rawMethod) ? rawMethod.join(", ") : rawMethod ?? "UNKNOWN";
   const path = record.routePath;
   const file = record.file ?? "";
-  const parsed = EndpointSchema.safeParse({
+  const parsed = EndpointSchema2.safeParse({
     method,
     path,
     handler: record.handler,
@@ -7653,169 +7731,415 @@ For each entry point, call \`document_endpoint\` with:
 
 When finished, call \`response\` with a summary of how many entry points you documented. The reported count must equal the number of successful \`document_endpoint\` calls you made.`;
 }
+function buildIncrementalObjective(codebasePath, diffPath, assetsPath, existingResult, domains, environments) {
+  const appsSummary = existingResult.apps.map((app) => {
+    const epCount = app.pages.length + app.apiEndpoints.length;
+    return `  - **${app.name}** (${app.framework}) at \`${app.location}\` — ${epCount} endpoints`;
+  }).join(`
+`);
+  const domainSection = domains?.length ? `
+## Known Domains
+The following domains are associated with this project. When documenting new apps, set the \`domain\` field on \`document_app\` if you can determine which domain serves the app:
+${domains.map((d) => `- ${d}`).join(`
+`)}
+` : "";
+  const environmentsSection = environments?.length ? `
+## Target Environments
+This project is deployed to: ${environments.join(", ")}. When the diff introduces new dynamically-named resources (e.g. environment-prefixed S3 buckets, stage-scoped databases), create a **separate app entry per environment** using the environment name as a prefix (e.g. \`${environments[0]}-<resource>\`). Use environment-specific identifiers in domains and endpoints.
+` : "";
+  return `# Incremental Attack Surface Update
+
+## Context
+You are updating the attack surface map for a repository after a new commit. Rather than analyzing the entire codebase, you will analyze only the **changed files** and update the existing endpoint assets accordingly. Also check for any new cloud resources (S3 buckets, storage, CDN origins, etc.) introduced in the diff.
+
+## Codebase
+- **Path:** ${codebasePath}
+- **Diff file:** ${diffPath} (contains \`git diff\` output between the previous and current commit)
+- **Existing assets directory:** ${assetsPath}
+${domainSection}${environmentsSection}
+## Directory Structure
+The assets directory uses app-scoped folders:
+\`\`\`
+assets/
+  <app-name>/
+    app.json           — app metadata (name, framework, description, location)
+    asset_*.json       — one file per endpoint (written by document_endpoint)
+\`\`\`
+
+## Existing Applications
+${appsSummary}
+
+## Task
+
+### Step 1: Read and understand the diff
+Read the diff file at \`${diffPath}\`. If it's very large, read it in chunks. Identify which files were added, modified, or deleted.
+
+### Step 2: Determine impact on the attack surface
+For each changed file, determine if it affects any endpoints:
+- **New route/endpoint definitions** → use \`document_endpoint\` with the appropriate \`appName\`
+- **Modified route handlers** → read the existing asset file, then use \`execute_command\` to update it
+- **Deleted route files or endpoint definitions** → delete the corresponding asset file
+- **Non-route changes** (e.g. utility functions, configs, tests) → skip
+
+### Step 3: Update assets
+For new endpoints, use \`document_endpoint\` with:
+- \`appName\` set to the correct application name
+- \`routePath\` set to the HTTP route (e.g., \`/api/users\`) — this is NOT a file path
+- \`method\` as an array of ALL HTTP methods the path supports
+- \`file\` set to the source-code file (e.g., \`src/routes/users.ts\`) — this is NOT the route
+- \`line\`, \`handler\`, \`authRequired\` filled in
+
+For modified endpoints, update the existing JSON file via \`execute_command\`.
+For removed endpoints, delete the file via \`execute_command\`.
+
+**IMPORTANT: ONE entry per route path.** Do NOT create separate entries for different HTTP methods on the same path.
+
+**IMPORTANT: NO MANIFESTS, NO BATCHING.** Call \`document_endpoint\` directly, one new endpoint at a time, the moment you identify it. Do not build a JSON file or list of endpoints-to-document and process it later, and do not write a script that emits \`document_endpoint\` calls — that pattern hits output-token limits and silently drops endpoints.
+
+### Step 4: Report
+When finished, call the \`response\` tool with a summary of your changes.
+
+**IMPORTANT:** Be conservative. Only add/modify/remove endpoints that are clearly affected by the diff. Do not re-analyze the entire codebase.`;
+}
+var IncrementalReconResultSchema = object({
+  repoType: string(),
+  packageManager: string(),
+  changedApps: array(string()).describe("Names of applications that were affected by the diff"),
+  addedEndpoints: number().describe("Count of new endpoints added"),
+  modifiedEndpoints: number().describe("Count of existing endpoints modified"),
+  removedEndpoints: number().describe("Count of endpoints removed"),
+  summary: string().describe("Brief summary of what changed")
+});
+async function readIncrementalReconAssets(backends, assetsPath, existing, abortSignal) {
+  const fs = backends.fs;
+  const list = async (path) => {
+    abortSignal?.throwIfAborted();
+    const result = await fs.list(path);
+    if (!result.success)
+      throw new Error(`Incomplete recon asset listing: ${path}`);
+    if (!result.truncated)
+      return result.files;
+    const files = [];
+    let total;
+    for (let offset = 0;; ) {
+      abortSignal?.throwIfAborted();
+      const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+      const output = await collectCommand(backends.command.run(`python3 -c ${quote(RECON_ARTIFACT_PAGE_SCRIPT)} ${quote(assetsPath)} ${quote(path)} ${offset}`, { timeoutSeconds: 30, abortSignal }));
+      if (output.exitCode !== 0 || output.timedOut || output.stdoutTruncated)
+        throw new Error(`Recon artifact enumeration failed: ${path}`);
+      const page = object({
+        files: array(string()).max(64),
+        total: number().int().min(0).max(1e5),
+        next: number().int().min(1).nullable()
+      }).parse(JSON.parse(output.stdout));
+      total ??= page.total;
+      if (page.total !== total || page.next !== null && page.next !== offset + page.files.length || page.next !== null && (page.files.length === 0 || page.next >= total))
+        throw new Error("Recon artifact enumeration did not advance consistently");
+      files.push(...page.files);
+      if (page.next === null) {
+        if (files.length !== total || new Set(files).size !== total)
+          throw new Error("Incomplete recon artifact pagination");
+        return files;
+      }
+      offset = page.next;
+    }
+  };
+  const read = async (path) => {
+    abortSignal?.throwIfAborted();
+    const result = await fs.readRaw(path);
+    if (!result.success)
+      throw new Error(`Recon artifact read failed: ${path}`);
+    return JSON.parse(result.content);
+  };
+  const apps = [];
+  for (const directory of await list(assetsPath)) {
+    if (!directory.endsWith("/"))
+      continue;
+    if (directory === "../" || directory === "./" || directory.slice(0, -1).includes("/"))
+      throw new Error("Invalid recon artifact directory");
+    const appPath = join16(assetsPath, directory);
+    const metadata = AppInfoSchema2.parse(await read(join16(appPath, "app.json")));
+    const previousApp = existing.apps.find((app) => app.name === metadata.name);
+    const app = {
+      ...previousApp,
+      ...metadata,
+      pages: [],
+      apiEndpoints: []
+    };
+    for (const file of await list(appPath)) {
+      if (file === "app.json" || !file.endsWith(".json"))
+        continue;
+      if (file.includes("/") || file === "..")
+        throw new Error("Invalid recon artifact filename");
+      const raw = await read(join16(appPath, file));
+      const record = object({
+        method: union([string(), array(string())]),
+        routePath: string()
+      }).passthrough().parse(raw);
+      const endpoint = assetRecordToEndpoint(record);
+      if (!endpoint)
+        throw new Error(`Invalid recon endpoint artifact: ${file}`);
+      const previous = previousApp && [...previousApp.pages, ...previousApp.apiEndpoints].find((ep) => ep.method === endpoint.method && ep.file === endpoint.file && ep.path === endpoint.path);
+      const restored = {
+        ...previous,
+        ...endpoint,
+        ...endpoint.riskScore ? {} : previous?.riskScore ? { riskScore: previous.riskScore } : {}
+      };
+      (isPageEndpoint(record) ? app.pages : app.apiEndpoints).push(restored);
+    }
+    apps.push(app);
+  }
+  return {
+    ...existing,
+    apps,
+    summary: {
+      totalApps: apps.length,
+      totalPages: apps.reduce((sum, app) => sum + app.pages.length, 0),
+      totalApiEndpoints: apps.reduce((sum, app) => sum + app.apiEndpoints.length, 0),
+      totalPentestObjectives: apps.reduce((sum, app) => sum + [...app.pages, ...app.apiEndpoints].reduce((count, ep) => count + ep.pentestObjectives.length, 0), 0)
+    }
+  };
+}
+var RECON_ARTIFACT_PAGE_SCRIPT = `import os,sys,json,itertools
+base=os.path.realpath(sys.argv[1]); directory=os.path.realpath(sys.argv[2]); offset=int(sys.argv[3])
+if os.path.commonpath([base,directory]) != base: raise ValueError("Artifact directory escaped root")
+with os.scandir(directory) as scan:
+ entries=list(itertools.islice(scan,100001))
+if len(entries)>100000: raise ValueError("Artifact inventory exceeds limit")
+if any(entry.is_symlink() for entry in entries): raise ValueError("Artifact links are not supported")
+files=sorted(entry.name+("/" if entry.is_dir() else "") for entry in entries)
+end=min(len(files),offset+64)
+print(json.dumps({"files":files[offset:end],"total":len(files),"next":end if end<len(files) else None}))`;
 
 // src/core/workflows/pentest.ts
 var log5 = scopedLogger(() => createLogger("pentest-swarm"));
 var DEFAULT_CONCURRENCY2 = 10;
-async function runPentestSwarm(input) {
+async function runPentestSwarmTarget(target, index, input) {
   const {
-    targets,
     model,
     session,
     authConfig,
     abortSignal,
     findingsRegistry,
     eventBus,
-    onError,
-    concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
     onCacheMetrics,
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
-    display
+    display,
+    onError,
+    hooks: sharedHooks,
+    seams,
+    manifestEntries,
+    completedIds
   } = input;
-  const completedIds = getCompletedAgentIds(session);
-  const existingManifest = readAgentManifest(session);
-  const freshEntries = buildManifestEntries(targets);
-  const manifestEntries = reconcileManifestOnResume(existingManifest, freshEntries);
-  writeAgentManifest(session, manifestEntries);
-  const results = await runWithBoundedConcurrency(targets, concurrency, async (target, index) => {
-    const entry = manifestEntries[index];
-    const subagentId = entry.id;
-    const subagentName = target.name ?? entry.name;
-    if (completedIds.has(subagentId))
-      return null;
-    const previousMessages = loadSubagentMessages(session, subagentId);
-    let lastMessages = [];
-    const handleStepFinish = (e) => {
-      if (e.response.messages) {
-        lastMessages = e.response.messages;
-      }
-      onStepFinish?.(e);
-    };
-    eventBus?.emit("subagent-spawn", {
-      subagentId,
-      name: subagentName,
-      input: { target: target.target, objectives: target.objectives }
-    });
-    if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
-      try {
-        eventBus?.emit("subagent-spawn", {
-          subagentId: `${subagentId}-plan`,
-          name: `${subagentName} (plan)`,
-          input: { target: target.target, objectives: target.objectives },
-          parentSubagentId: subagentId
-        });
-        const executionTasksDir = join18(session.rootPath, "subagents", `${subagentId}-tasks`);
-        const planAgent = new OffensiveSecurityAgent({
-          system: PLAN_PHASE_SYSTEM_PROMPT,
-          prompt: buildPlanPrompt(target.target, target.objectives, target.grpc),
-          model,
-          session,
-          target: target.target,
-          grpc: target.grpc,
-          mode: "plan",
-          activeTools: [...PLAN_MODE_TOOL_NAMES],
-          stopWhen: hasToolCall("submit_plan"),
-          authConfig,
-          abortSignal,
-          findingsRegistry,
-          subagentId: `${subagentId}-plan`,
-          subagentName: `${subagentName} (plan)`,
-          tasksDir: executionTasksDir,
-          planSubagentId: subagentId,
-          eventBus,
-          onStepFinish,
-          onCacheMetrics,
-          enableThinking,
-          thinkingEffort,
-          openAIReasoningEffort,
-          display
-        });
-        await planAgent.consume();
-        eventBus?.emit("subagent-complete", {
-          subagentId: `${subagentId}-plan`,
-          status: "completed",
-          parentSubagentId: subagentId
-        });
-      } catch (planErr) {
-        eventBus?.emit("subagent-complete", {
-          subagentId: `${subagentId}-plan`,
-          status: "failed",
-          parentSubagentId: subagentId
-        });
-        log5.warn(`Plan phase failed for ${subagentId}: ${planErr}`);
-      }
+  const entry = manifestEntries[index];
+  const subagentId = entry.id;
+  const subagentName = target.name ?? entry.name;
+  if (completedIds.has(subagentId))
+    return null;
+  const itemHooks = resolveItemHooks(sharedHooks, seams, target, index);
+  const childSignal = abortSignal && itemHooks.abortSignal ? AbortSignal.any([abortSignal, itemHooks.abortSignal]) : abortSignal ?? itemHooks.abortSignal;
+  const previousMessages = loadSubagentMessages(session, subagentId);
+  let lastMessages = [];
+  const handleStepFinish = (e) => {
+    if (e.response.messages) {
+      lastMessages = e.response.messages;
     }
-    const objectiveStr = target.objectives.join("; ");
-    let agent;
+    onStepFinish?.(e);
+  };
+  await seams.hooks.onEndpointStart?.({
+    subagentId,
+    subagentName,
+    target: target.target
+  });
+  eventBus?.emit("subagent-spawn", {
+    subagentId,
+    name: subagentName,
+    input: { target: target.target, objectives: target.objectives }
+  });
+  if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
     try {
-      agent = new TargetedPentestAgent({
-        target: target.target,
-        grpc: target.grpc,
-        objectives: target.objectives,
+      eventBus?.emit("subagent-spawn", {
+        subagentId: `${subagentId}-plan`,
+        name: `${subagentName} (plan)`,
+        input: { target: target.target, objectives: target.objectives },
+        parentSubagentId: subagentId
+      });
+      const executionTasksDir = join17(session.rootPath, "subagents", `${subagentId}-tasks`);
+      const planAgent = new OffensiveSecurityAgent({
+        system: PLAN_PHASE_SYSTEM_PROMPT,
+        prompt: buildPlanPrompt(target.target, target.objectives, target.grpc),
         model,
         session,
+        target: target.target,
+        grpc: target.grpc,
+        mode: "plan",
+        activeTools: [...PLAN_MODE_TOOL_NAMES],
+        stopWhen: hasToolCall("submit_plan"),
         authConfig,
-        abortSignal,
         findingsRegistry,
-        onStepFinish: handleStepFinish,
-        onCacheMetrics,
-        forwardUsageCallbacksToSpawnedAgents: true,
-        messages: previousMessages.length > 0 ? previousMessages : undefined,
+        subagentId: `${subagentId}-plan`,
+        subagentName: `${subagentName} (plan)`,
+        tasksDir: executionTasksDir,
+        planSubagentId: subagentId,
         eventBus,
-        subagentId,
-        subagentName,
+        onStepFinish,
+        onCacheMetrics,
         enableThinking,
         thinkingEffort,
         openAIReasoningEffort,
-        display
+        display,
+        ...itemHooks,
+        abortSignal: childSignal
       });
-      const result = await agent.consume();
-      saveSubagentData(session, {
-        agentName: subagentId,
-        target: target.target,
-        objective: objectiveStr,
+      await planAgent.consume();
+      eventBus?.emit("subagent-complete", {
+        subagentId: `${subagentId}-plan`,
         status: "completed",
-        findingsCount: result.findings.length,
-        messages: [...previousMessages, ...lastMessages],
-        systemPrompt: buildPentestSystemPrompt(session),
-        userPrompt: agent.userPrompt
+        parentSubagentId: subagentId
       });
-      updateManifestEntryStatus(session, subagentId, "completed");
+    } catch (planErr) {
       eventBus?.emit("subagent-complete", {
-        subagentId,
-        status: "completed"
-      });
-      return result;
-    } catch (error) {
-      saveSubagentData(session, {
-        agentName: subagentId,
-        target: target.target,
-        objective: objectiveStr,
+        subagentId: `${subagentId}-plan`,
         status: "failed",
-        error: error instanceof Error ? error.message : String(error),
-        messages: [...previousMessages, ...lastMessages],
-        systemPrompt: buildPentestSystemPrompt(session),
-        userPrompt: agent?.userPrompt ?? ""
+        parentSubagentId: subagentId
       });
-      updateManifestEntryStatus(session, subagentId, "failed");
-      eventBus?.emit("subagent-complete", {
-        subagentId,
-        status: "failed"
-      });
-      eventBus?.emit("error", { error, subagentId });
-      onError?.(error);
-      throw error;
+      log5.warn(`Plan phase failed for ${subagentId}: ${planErr}`);
     }
-  }, abortSignal);
+  }
+  const objectiveStr = target.objectives.join("; ");
+  let agent;
+  try {
+    agent = new TargetedPentestAgent2({
+      target: target.target,
+      grpc: target.grpc,
+      objectives: target.objectives,
+      model,
+      session,
+      authConfig,
+      findingsRegistry,
+      onStepFinish: handleStepFinish,
+      onCacheMetrics,
+      forwardUsageCallbacksToSpawnedAgents: true,
+      messages: previousMessages.length > 0 ? previousMessages : undefined,
+      eventBus,
+      subagentId,
+      subagentName,
+      enableThinking,
+      thinkingEffort,
+      openAIReasoningEffort,
+      display,
+      ...itemHooks,
+      abortSignal: childSignal
+    });
+    const result = await agent.consume();
+    saveSubagentData(session, {
+      agentName: subagentId,
+      target: target.target,
+      objective: objectiveStr,
+      status: "completed",
+      findingsCount: result.findings.length,
+      messages: [...previousMessages, ...lastMessages],
+      systemPrompt: buildPentestSystemPrompt2(session),
+      userPrompt: agent.userPrompt
+    });
+    updateManifestEntryStatus(session, subagentId, "completed");
+    eventBus?.emit("subagent-complete", {
+      subagentId,
+      status: "completed"
+    });
+    await seams.hooks.onEndpointDone?.({ subagentId, subagentName, target: target.target }, result);
+    return result;
+  } catch (error) {
+    saveSubagentData(session, {
+      agentName: subagentId,
+      target: target.target,
+      objective: objectiveStr,
+      status: "failed",
+      error: error instanceof Error ? error.message : String(error),
+      messages: [...previousMessages, ...lastMessages],
+      systemPrompt: buildPentestSystemPrompt2(session),
+      userPrompt: agent?.userPrompt ?? ""
+    });
+    updateManifestEntryStatus(session, subagentId, "failed");
+    eventBus?.emit("subagent-complete", {
+      subagentId,
+      status: "failed"
+    });
+    eventBus?.emit("error", { error, subagentId });
+    await seams.hooks.onEndpointFailed?.({ subagentId, subagentName, target: target.target }, error);
+    onError?.(error);
+    throw error;
+  }
+}
+async function runPentestSwarm2(input) {
+  const {
+    targets,
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    findingsRegistry: rawFindingsRegistry,
+    eventBus,
+    onError,
+    concurrency = DEFAULT_CONCURRENCY2,
+    onStepFinish,
+    onCacheMetrics,
+    enableThinking,
+    thinkingEffort,
+    openAIReasoningEffort,
+    display,
+    subagentSpawner,
+    languageModelMiddleware,
+    usageRecorder,
+    streamIdFactory,
+    hooks,
+    seams: inputSeams
+  } = input;
+  const seams = inputSeams ?? inProcessSeams({ fanOut: hooks?.subagentSpawner ?? subagentSpawner });
+  assertDepth(1, seams.limits);
+  const spawner = subagentSpawner ?? inProcessSubagentSpawner;
+  const sharedHooks = {
+    subagentSpawner: spawner,
+    languageModelMiddleware,
+    usageRecorder,
+    streamIdFactory,
+    ...hooks
+  };
+  const findingsRegistry = withFindingPersistedHook(rawFindingsRegistry, seams.hooks.onFindingPersisted);
+  const completedIds = getCompletedAgentIds(session);
+  const existingManifest = readAgentManifest(session);
+  const freshEntries = buildManifestEntries(targets, (name, ordinal) => seams.ids.newSessionId(name, ordinal));
+  const manifestEntries = reconcileManifestOnResume(existingManifest, freshEntries);
+  writeAgentManifest(session, manifestEntries);
+  const targetInput = {
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    findingsRegistry,
+    eventBus,
+    onStepFinish,
+    onCacheMetrics,
+    enableThinking,
+    thinkingEffort,
+    openAIReasoningEffort,
+    display,
+    onError,
+    hooks: sharedHooks,
+    seams,
+    manifestEntries,
+    completedIds
+  };
+  const results = await seams.fanOut.spawnMany(targets, (target, index) => runPentestSwarmTarget(target, index, targetInput), { concurrency, abortSignal });
   finalizeManifest(session, manifestEntries, results);
   return results;
 }
-async function runPentestWorkflow(input) {
+async function runPentestWorkflow2(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-a54atjc8.js");
+    const { runFastStrike } = await import("./fastStrike-mgws2nav.js");
     return runFastStrike(input);
   }
   const {
@@ -7835,6 +8159,18 @@ async function runPentestWorkflow(input) {
     threatModel,
     surfaceIntegrationEnabled
   } = input;
+  const seams = input.seams ?? inProcessSeams({
+    fanOut: input.hooks?.subagentSpawner ?? input.subagentSpawner,
+    registries: {
+      findings: () => FindingsRegistry.fromDirectory(session.findingsPath, {
+        model,
+        authConfig,
+        abortSignal,
+        sessionId: session.id
+      }),
+      attackSurface: inMemoryRegistryProvider.attackSurface
+    }
+  });
   if (prompt || threatModel) {
     const parts = [];
     if (threatModel)
@@ -7891,7 +8227,16 @@ ${combined}` : combined;
           onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
-          surfaceIntegrationEnabled
+          surfaceIntegrationEnabled,
+          subagentSpawner: input.subagentSpawner,
+          hooks: {
+            subagentSpawner: input.subagentSpawner,
+            languageModelMiddleware: input.languageModelMiddleware,
+            usageRecorder: input.usageRecorder,
+            streamIdFactory: input.streamIdFactory,
+            ...input.hooks
+          },
+          seams
         });
       } else {
         swarmTargets = await runBlackboxPhase({
@@ -7903,7 +8248,14 @@ ${combined}` : combined;
           eventBus,
           onStepFinish,
           onCacheMetrics,
-          openAIReasoningEffort
+          openAIReasoningEffort,
+          hooks: {
+            subagentSpawner: input.subagentSpawner,
+            languageModelMiddleware: input.languageModelMiddleware,
+            usageRecorder: input.usageRecorder,
+            streamIdFactory: input.streamIdFactory,
+            ...input.hooks
+          }
         });
       }
       eventBus?.emit("workflow-phase-complete", {
@@ -7918,35 +8270,31 @@ ${combined}` : combined;
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
     if (swarmTargets.length === 0) {
-      const report2 = buildPentestReport([], {
+      const report = buildPentestReport([], {
         target,
         model,
         sessionId: session.id,
         mode
       });
-      const mdPath2 = join18(session.rootPath, REPORT_FILENAME_MD);
-      const jsonPath2 = join18(session.rootPath, REPORT_FILENAME_JSON);
-      writeFileSync4(mdPath2, renderMarkdown(report2));
-      writeFileSync4(jsonPath2, renderJson(report2));
+      const mdPath = join17(session.rootPath, REPORT_FILENAME_MD);
+      const jsonPath = join17(session.rootPath, REPORT_FILENAME_JSON);
+      writeFileSync4(mdPath, renderMarkdown(report));
+      writeFileSync4(jsonPath, renderJson(report));
       return {
         findings: [],
         findingsPath: session.findingsPath,
         pocsPath: session.pocsPath,
-        reportPath: mdPath2
+        reportPath: mdPath
       };
     }
     eventBus?.emit("workflow-phase-start", {
       phase: "pentesting",
       label: `Pentest Swarm (${swarmTargets.length} targets)`
     });
-    const findingsRegistry = FindingsRegistry.fromDirectory(session.findingsPath, {
-      model,
-      authConfig,
-      abortSignal
-    });
+    const findingsRegistry = seams.registries.findings();
     const completedCount = getCompletedAgentIds(session).size;
     if (completedCount < swarmTargets.length) {
-      await runPentestSwarm({
+      await runPentestSwarm2({
         targets: swarmTargets,
         model,
         session,
@@ -7958,7 +8306,13 @@ ${combined}` : combined;
         onCacheMetrics,
         enableThinking,
         thinkingEffort,
-        openAIReasoningEffort
+        openAIReasoningEffort,
+        subagentSpawner: input.subagentSpawner,
+        languageModelMiddleware: input.languageModelMiddleware,
+        usageRecorder: input.usageRecorder,
+        streamIdFactory: input.streamIdFactory,
+        hooks: input.hooks,
+        seams
       });
     }
     if (abortSignal?.aborted) {
@@ -7976,8 +8330,8 @@ ${combined}` : combined;
       sessionId: session.id,
       mode
     });
-    const mdPath = join18(session.rootPath, REPORT_FILENAME_MD);
-    const jsonPath = join18(session.rootPath, REPORT_FILENAME_JSON);
+    const mdPath = join17(session.rootPath, REPORT_FILENAME_MD);
+    const jsonPath = join17(session.rootPath, REPORT_FILENAME_JSON);
     writeFileSync4(mdPath, renderMarkdown(report));
     writeFileSync4(jsonPath, renderJson(report));
     const severityCounts = {};
@@ -8018,26 +8372,30 @@ async function runWhiteboxPhase(opts) {
     onStepFinish: opts.onStepFinish,
     onCacheMetrics: opts.onCacheMetrics,
     openAIReasoningEffort: opts.openAIReasoningEffort,
-    surfaceIntegrationEnabled: opts.surfaceIntegrationEnabled
+    surfaceIntegrationEnabled: opts.surfaceIntegrationEnabled,
+    subagentSpawner: opts.subagentSpawner,
+    hooks: opts.hooks,
+    seams: opts.seams
   };
   const result = await runWhiteboxAttackSurfaceWorkflow(workflowInput);
   return result.apps.flatMap((app) => [...app.pages, ...app.apiEndpoints].map((ep) => {
-    const grpc2 = toGrpcPentestContext(ep.transport, ep.grpc, ep.path);
+    const grpc = toGrpcPentestContext(ep.transport, ep.grpc, ep.path);
     return {
-      target: grpcAuthorityTarget(grpc2, ep.path) ?? (ep.path.startsWith("http") ? ep.path : `${opts.baseTarget}${ep.path}`),
+      target: grpcAuthorityTarget(grpc, ep.path) ?? (ep.path.startsWith("http") ? ep.path : `${opts.baseTarget}${ep.path}`),
       objectives: ep.pentestObjectives,
-      grpc: grpc2
+      grpc
     };
   }));
 }
 async function runBlackboxPhase(opts) {
   let lastMessages = [];
   const agentInput = {
+    ...opts.hooks,
     target: opts.target,
     model: opts.model,
     session: opts.session,
     authConfig: opts.authConfig,
-    abortSignal: opts.abortSignal,
+    abortSignal: opts.abortSignal && opts.hooks?.abortSignal ? AbortSignal.any([opts.abortSignal, opts.hooks.abortSignal]) : opts.abortSignal ?? opts.hooks?.abortSignal,
     eventBus: opts.eventBus,
     subagentId: "attack-surface-agent",
     onStepFinish: (e) => {
@@ -8049,7 +8407,7 @@ async function runBlackboxPhase(opts) {
     onCacheMetrics: opts.onCacheMetrics,
     openAIReasoningEffort: opts.openAIReasoningEffort
   };
-  const agent = new BlackboxAttackSurfaceAgent(agentInput);
+  const agent = new BlackboxAttackSurfaceAgent2(agentInput);
   opts.eventBus?.emit("subagent-spawn", {
     subagentId: "attack-surface-agent",
     name: "Attack Surface Discovery",
@@ -8086,4 +8444,4 @@ async function runBlackboxPhase(opts) {
     throw e;
   }
 }
-export { readExecutionMetrics, writeExecutionMetrics, convertModelMessagesToUI, loadSubagents, DEFAULT_CONCURRENCY2 as DEFAULT_CONCURRENCY, runPentestSwarm, runPentestWorkflow };
+export { readExecutionMetrics, writeExecutionMetrics, convertModelMessagesToUI, loadSubagents, DEFAULT_CONCURRENCY2, runPentestSwarm2, runPentestWorkflow2 };